Retro Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Retro Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A sprint retrospective grounded in what actually happened, not what people remember.
Retros run on memory, so they run on bias. The loudest voice and the last few days win, the same complaints come back every sprint, and the action items quietly never happen. Meanwhile the actual record of the sprint, the reopened ticket, the PR that sat two days in review, the Slack thread where someone said they were blocked, is sitting right there in your tools, unused.
retro-mcp reads that record and hands you a retro built from it. You ask your AI assistant for the retro and it answers with what went well, what didn't, and action items, every line backed by a specific metric, ticket, PR, or thread. It frames everything around the process, never individuals, and it flags the problems that keep recurring across sprints.
It is a standard Model Context Protocol server, so it works in any MCP client (Claude, Cursor, Cline, and more) on any model. It is local and read-only: nothing about your sprint leaves your machine except the calls to your own tools' APIs, and it needs no AI API key. That is also the answer to the obvious worry: it is a retro aid, not a surveillance tool.
It ships with a realistic closed sprint and runs against it automatically when no credentials are set:
npx -y retro-mcp --demoHere is the headline tool on that demo sprint:
# Sprint Retrospective: MBANK Sprint 23
_May 27 to Jun 10. Demo data, no credentials configured._
_Grounded in 8 issues, 5 merged PRs, and 4 flagged threads. System-level and blameless: this is about the process, not people._
## What went well
- **Work moved through faster than last sprint.** avg cycle time 4.6d, down from 5.6d.
## What did not go well
- **The sprint fell short of its commitment.** only 23 of 34 pts done (68%). ⟳ recurring across recent sprints
- **Scope grew mid-sprint.** +5 pts across 2 issues pulled in after the sprint started. ⟳ recurring across recent sprints
- **Work carried over into the next sprint.** 3 issues (16 pts) not finished. ⟳ recurring across recent sprints
- **Some work was called done before it was.** MBANK-203 · reopened 1 time: Statement PDF export.
- **Code review was a bottleneck.** PRs waited 20.3h on average for a first review; PR #503 · sat 52h: statement PDF export.
- **Changes had to be reverted or hotfixed.** PR #504 · revert: OTP delivery change; 1 hotfix merged.
- **The team hit repeated blockers and interruptions.** 2 threads mentioned being blocked; 1 thread mentioned an incident.
## Action items
- [ ] (recurring) Adopt a scope-change rule: anything pulled in mid-sprint bumps something out, decided at standup, not silently.
- [ ] (recurring) Pull less or split large items so they finish inside the sprint.
- [ ] Tighten the definition of done: an explicit QA check before anything moves to Done.
- [ ] Add a pre-merge guard on risky changes: a second approval or a smoke test before merge.
## Discussion prompts
- MBANK-203 was reopened once. What made it hard to call done the first time?
- +5 pts came in after the sprint started. What drove the mid-sprint adds?
- PR #504 had to be reverted. What would have surfaced the problem before it merged?Every line points at something real. Nobody typed it from memory, and the three recurring problems are flagged as patterns, not fresh complaints.
Six tools. Everything defaults to the most recently closed sprint.
| Tool | What you get |
|---|---|
retro_brief | The full retro: went well / didn't / action items / discussion prompts, every line evidence-backed, recurring themes flagged. |
retro_metrics | The evidence base: completion, mid-sprint scope change, carryover, reopens, cycle time vs prior, velocity, PR review latency, reverts, flagged threads. |
action_item_review | Paste last retro's action items; it attaches this sprint's data to each, so you see what actually moved. |
discussion_prompts | Open questions for the board, each grounded in a real anomaly. Questions, not verdicts. |
sprint_compare | This sprint vs the prior one, plus the problem themes recurring across recent sprints. |
list_sources | Which sources are wired, or that you are on demo data. |
Every other retro tool is a digital sticky-note board: humans still type the observations from memory, and the "AI" ones just cluster the notes people already wrote. retro-mcp derives the observations from the data itself, across Jira, GitHub, and Slack at once. Specifically:
action_item_review puts last retro's items next to this sprint's data.<details> <summary><b>Example: action_item_review</b></summary>
# Last retro's action items, against this sprint's data
_Demo data. Evidence only. You decide what counts as done._
- **Speed up PR reviews so nothing sits more than a day**
- avg PR review latency this sprint: 20.3h
- slowest review: PR #503 at 52h
- **Stop pulling unplanned work into the sprint mid-flight**
- scope added mid-sprint: +5 pts (2 issues)
- completion: 68%
- **Finish what we commit to and cut the carryover**
- carryover this sprint: 3 issues (16 pts)It does not declare done or not done. It surfaces the evidence and lets the team judge, which keeps it honest. </details>
Jira is the spine of a retro, so live mode needs it. GitHub and Slack are optional enrichment, scoped to the closed sprint's dates.
| Variable | Source | Notes |
|---|---|---|
JIRA_BASE_URL JIRA_EMAIL JIRA_API_TOKEN | Jira | Required for live. Cloud site, account email, and an API token. |
JIRA_BOARD_ID | Jira | Optional. Pin a board when the account has several. |
GITHUB_TOKEN GITHUB_REPOS | GitHub | Optional. Read-only token and the team's repos (owner/name, comma-separated) for PR review latency and reverts. |
SLACK_TOKEN SLACK_CHANNELS | Slack | Optional. Read token and the sprint channel ids (comma-separated) to scan for blocker and incident language. |
Verify before wiring it into a client:
JIRA_BASE_URL=https://you.atlassian.net [email protected] JIRA_API_TOKEN=xxx npx -y retro-mcp --checkAdd this to claude_desktop_config.json (Settings, Developer, Edit Config), then restart:
{
"mcpServers": {
"retro": {
"command": "npx",
"args": ["-y", "retro-mcp"],
"env": {
"JIRA_BASE_URL": "https://your-company.atlassian.net",
"JIRA_EMAIL": "[email protected]",
"JIRA_API_TOKEN": "your-jira-token",
"GITHUB_TOKEN": "ghp_your_token",
"GITHUB_REPOS": "your-org/your-app",
"SLACK_TOKEN": "xoxp-your-token",
"SLACK_CHANNELS": "C0123ENG"
}
}
}
}Leave the env block out to run on demo data first. Include only the sources you use. Cursor, Cline, Continue, Zed, and Windsurf read the same mcpServers JSON.
src/
index.ts MCP server, stdio transport, --demo/--check/--help
config.ts env resolution, demo-mode detection
gather.ts one place that pulls the sprint, PRs, and signals together
provider.ts aggregator over Jira + GitHub + Slack
types.ts normalized domain types and source interfaces
jira/normalize.ts raw Jira to normalized, plus the ADF flattener
sources/ jira, github, slack clients, plus the demo provider
analytics/ metrics, themes, findings, actionReview, prompts, brief
tools/ one MCP tool per file, thin wrappers over analyticsnpm test).test/normalize.test.ts).test/retro.test.ts).npm run smoke).The demo proves the engine. It does not prove each live client against every account shape, which is why the parse layer is unit tested separately and each source is kept small and tolerant. Run --check to confirm your own connections.
I run delivery for SaaS and fintech teams, and I build tools like this with Claude Code. This is the third in a set of PM-focused MCP servers, after jira-pm-mcp and standup-mcp. If it makes your retro sharper, I would like to hear how you use it.
Issues and pull requests are welcome.
MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.